[Buildroot] [PATCH 2025.02.x] package/util-linux: fix loopdev-fl-nofollow patch
Jasper van der Neut
jasper at isotopic.nl
Thu May 7 16:12:30 UTC 2026
ul_canonicalize_path is not available in util-linux 2.40, so build will
fail with an unresolved reference.
Signed-off-by: Jasper van der Neut <jasper at isotopic.nl>
---
package/util-linux/0006-add-loopdev-fl-nofollow.patch | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/package/util-linux/0006-add-loopdev-fl-nofollow.patch b/package/util-linux/0006-add-loopdev-fl-nofollow.patch
index 21b1e2596c..228c570554 100644
--- a/package/util-linux/0006-add-loopdev-fl-nofollow.patch
+++ b/package/util-linux/0006-add-loopdev-fl-nofollow.patch
@@ -8,7 +8,7 @@ prevents symlink following in both path canonicalization and file open.
When set:
- loopcxt_set_backing_file() uses strdup() instead of
- ul_canonicalize_path() (which calls realpath() and follows symlinks)
+ canonicalize_path() (which calls realpath() and follows symlinks)
- loopcxt_setup_device() adds O_NOFOLLOW to open() flags
The flag is set for non-root (restricted) mount operations in
@@ -28,13 +28,13 @@ Vulnerable Code Flow:
hook_loopdev.c: setup_loopdev()
backing_file = fstab source path ("/home/user/disk.img")
loopcxt_set_backing_file() <-- calls realpath() as ROOT
- ul_canonicalize_path() <-- follows symlinks!
+ canonicalize_path() <-- follows symlinks!
loopcxt_setup_device()
open(lc->filename, O_RDWR|O_CLOEXEC) <-- no O_NOFOLLOW
Two vulnerabilities in the path:
-1) loopcxt_set_backing_file() calls ul_canonicalize_path() which uses
+1) loopcxt_set_backing_file() calls canonicalize_path() which uses
realpath() -- this follows symlinks as euid=0. If the attacker swaps
the file to a symlink before this call, lc->filename becomes the
resolved target path (e.g., /root/secret.img).
@@ -82,7 +82,7 @@ index c72fb2c40..3d2274693 100644
+ if (lc->flags & LOOPDEV_FL_NOFOLLOW)
+ lc->filename = strdup(filename);
+ else
-+ lc->filename = ul_canonicalize_path(filename);
++ lc->filename = canonicalize_path(filename);
if (!lc->filename)
return -errno;
--
2.43.0
More information about the buildroot
mailing list